11 replies to this topic

[sudarshan123]

Hi,
I have Installshield 10.5.
I cannot successfully install the msi on vista when UAC is turned on.
I cannot turn it off.
So how should I able to achieve this?I understand that which UAC om msi needs elevated execution privilage in order to run successfully.When I cannot do this directly, I have to run it from an elevated command prompt , which is not an acceptible solution for our customers.
So is there a way we can achieve this. From the forums I got the hint that this can be done by properly authoring the msm, in the sense it may have an iplication on the custom action.
If anyone can come with a good solution it shall be highly appreciated.
Thanks
Sudarshan

[Stefan Krueger]

It depends on why your setup fails. You should try to fix your setup before looking for workarounds like running the whole setup elevated. A typical mistake is custom actions that are scheduled for "deferred" execution when they should be "deferred in system context".

[sudarshan123]

Hi there ,
thanks for your prompt reply.
I changed all the deferred to defered with System context for all my custom actions, and for all the custom actions in the redistributables.
Now things are better but one of the custom action functions is still giving trouble, when I try to remove the product using my msi.I get an error message saying thi sfunction caused an error. This particular function is actually a custom action within one of my redistributables which is included in the ism.
Any idea what might be happening...
Also on vista I have no option to install as administrator for a msi. I created this option by creating a few registry keys under HKEY_CLASSES_ROOT\Msi.Package\shell, and setting the default value to msiexec /i "%1". Now this allows me to run my msi in elevated mode and the installation, removal etc of my product goes smoothly. But this is not really an option because I cannot ask customers to play with their registries.However, this leads me to beleive that I need elevated rights to successfully install my msi.
Any further suggestion or any hint about I should further investigate this issue would be of immense help.
Thanks again.
Sudarshan

[Stefan Krueger]

First, I'd encourage you to continue on your good way and fix the remaining custom action problem instead of taking the shortcut.
But to answer your question: when launched from a setup.exe you should get a UAC prompt right at the start.

[sudarshan123]

Hi Stefan,
Thanks again to begin with.
Thats what i am trying to do, but found out from one of your articles that for this to work installation with elevated privileges should be enabled.
As I am trying to figure out how to do this (looking on msdn sites) , will it have any security side affect?
My product management shall not approve of any situation which might cause a security hole.
Also I am using installshield 10.5. Does a later version have a solution for this?
Thanks a lot Stefan for your prompt replies.
Sudarshan

[Stefan Krueger]

The elevation is limited to the runtime of your install program, so the impact is limited. However you shouldn't launch your application from the setup because it would run with elevated privileges, too.

[sudarshan123]

Hi Stefan,
Thanks a lot for your continued help.
Well now, install , removal everything works after i adjusted the custom actions and also some C++ code, such that some of .exe can be run with elevated privileges.
There is still one problem remaining.I cannot launch my exe as i complete installation from my setup.msi.
The precise problem is as follows:
Presently custom actions have been adjusted to accomodate UAC.
Now as my msi succesfully installs my product (Desktop Agent), there is a checkbox, which if clicked should launch the exe (CosmoAgent.exe).
Now the install creates a shortcut on desktop for this exe. Previously user could not launch this exe even from the desktop with UAC turned on.Now I have added a manifest file on the same directory as cosmoagent.exe which indicates that Administrative privilege is required for this exe.
But even with this manifest file, when I try to launch this exe from my setup.msi (after a successful installation), exe does not get launched.Previoulsy I used to get an error, after addition of the manifest file I dont get any error but exe does not launches.
Also if I am installing this from an elevated command prompt using msiexec /i, the exe gets launched successfully from the setup.
Now the only way to run this exe is to run it from desktop after it gets installed, which is not an acceptible state for my product.
Can you please suggest something?
Thanks
Sudarshan

Edited by sudarshan123, 14 February 2008 - 20:42.

[Stefan Krueger]

Running your application with elevated rights could be a much more serious security risk than running your installer elevated.
In the custom action that launches the exe, did you specify the working directory?

[masterjonte]

I have the same problem in VISTA. I have a MSI that has to check in the registry for: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Visual Studio 2005 Team Edition for Software Developers - ENU

But my MSI can't read that key value anymore. And it must be that UAC is enabled. Because if I run it like an exe it works and if I run my MSI in a elevated command window it can read registry.

So how can a admistrator in VISTA run MSI? Where is the concept of MSI when I can't run it standalone from desktop?

[Stefan Krueger]

Using RegEdit please check the permissons on this key. Maybe it was explicitly set to be not readable for users. This would not be the typical configuration but maybe the VSTS installer did something special here. You can also use SysInternal's ProcessMonitor to verify that it's an access permission problem.

Can you read other uninstall registry entries?

[sudarshan123]

Hi Stefan,
It seems problems with Vista and UAC wont go away.
Now my problem is I cannot register using regserver.
I have a custom acctions which has cmd /c CosmoAgent.exe /unregserver or
cmd /c CosmoAgent.exe /regserver in their Filename and Commandline fields.
Now after I install my product I cannot launch my product as a common user.
I can only run them as administrator, or if I run the CosmoAgent.exe /regserver from an elevated command prompt.
So is there a way from Installshield that I can start an elevated command promt in order to run these commands.
All these custom actions are marked as run deferred in system context.
Also can I write this custom action in c++ using ShellExecuteEx command?
I will be grateful if you would offer me with some suggestion.
Thanks a lot
Sudarshan

[Stefan Krueger]

Follow up to this question here:
http://forum.install...showtopic=17797